feat: scan host LAN web devices via proxy

internal/webdevice/proxy_test.go

@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestRewriteLocation(t *testing.T) {
@@ -91,3 +92,64 @@ func TestProxyHTTPServesAllowedTarget(t *testing.T) {
 		t.Fatalf("body = %s", rec.Body.String())
 	}
 }
+
+func TestProxyHTTPClosesUpstreamConnection(t *testing.T) {
+	t.Parallel()
+
+	closeSeen := make(chan bool, 1)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		closeSeen <- r.Close
+		w.Header().Set("Content-Type", "text/plain")
+		_, _ = w.Write([]byte("ok"))
+	}))
+	defer upstream.Close()
+
+	svc := NewService()
+	svc.allowIP("192.168.1.124")
+	svc.proxyTarget = func(ip string) string {
+		return upstream.URL
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "http://portal/proxy/web/192.168.1.124/", nil)
+	rec := httptest.NewRecorder()
+
+	if err := svc.ProxyHTTP(rec, req, "192.168.1.124", "/"); err != nil {
+		t.Fatalf("ProxyHTTP() error = %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+
+	select {
+	case got := <-closeSeen:
+		if !got {
+			t.Fatal("upstream request Close = false, want true")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for upstream request")
+	}
+}
+
+func TestSanitizeProxyRequestHeaderDropsLoginCookie(t *testing.T) {
+	source := http.Header{}
+	source.Set("User-Agent", "browser")
+	source.Set("Cookie", "SID=1")
+	source.Set("Referer", "http://10.8.0.18:13000/proxy/web/192.168.0.108/")
+	source.Set("X-Forwarded-For", "10.8.0.1")
+
+	loginHeader := sanitizeProxyRequestHeader(source, "/doc/page/login.asp")
+	if got := loginHeader.Get("Cookie"); got != "" {
+		t.Fatalf("login Cookie = %q, want empty", got)
+	}
+	if got := loginHeader.Get("Referer"); got != "" {
+		t.Fatalf("login Referer = %q, want empty", got)
+	}
+	if got := loginHeader.Get("X-Forwarded-For"); got != "" {
+		t.Fatalf("login X-Forwarded-For = %q, want empty", got)
+	}
+
+	apiHeader := sanitizeProxyRequestHeader(source, "/ISAPI/Security/userCheck")
+	if got := apiHeader.Get("Cookie"); got != "SID=1" {
+		t.Fatalf("api Cookie = %q, want SID=1", got)
+	}
+}